Denial Of Service attacks (DDOS)

[RacingJim]

ANyone been a victim of attacks to bring down your sites? What do you do to mitigate it?

I have been looking at the Cloudflare service as I have been getting repeated attacks on one partoicular site that is starting to do well in the search engines.

Seems people are playing really dirty in the gambling niche in 2015, but I'm sure these things probably aren't new. Any advice/ help appreciated.

[Sherlock]

All the time. I have a good linux admin that can solve it. It is costly though. Hosting that cares is much more expensive than some regular hosting, even if it is a dedicated server. I can recommend a guy who cares, for managed servers, but the cost will be I think at least 200 E / month for a very small server.

The quality of hostings can differ in many parameters and it counts so much... the protection is one of those things. It is also about speed. Some places offer you the protection, but they respond tickets in few hours. I know that I can wake up my IT and he is online in one minute anytime solving it. But yes, if one wants someone to solve things immediately it cost you money. Then those higher costs must be compared to the money you lose with the attacks.

[universal4]

The DDOS attacks have been going on for MANY years.

There are many ways to combat various attacks, it often depends on the type and scope of what is happening.

Having mail, dns, webs and other services on different servers helps a little since security on each server can then be geared to specifically guard that service. This also helps since in most cases a web server need only have a few ports open to the outside. (80 and 21 and 443 if https is enabled) If you must open other ports for such things as management or remote, allowing only specific ip's or subnets access to those specific ports helps reduce the attack surface also.

If it is necessary to have multiple services on a single server, using a firewall that blocks all ports except those absolutely necessary is a start.

If you seem to be getting attacked from specific subnets (class B's and class C's) you can try blocking some of those subnets to reduce the attack itself, and you may also consider speaking with your upstream provider and consider some blocking at the router level when absolutely necessary.

If running wordpress, be sure to use a method of moving or renaming the administration login (such as we discussed in a recent thread here at the GPWA).

And no matter WHAT method you decide to use or try, ALWAYS be sure to use strong passwords for all logins, web admin, wordpress admin, email logins, ftp etc.

Rick
Universal4

Maybe Dan and a few of the other more security savvy guys can ring in here, I know that Dan may likely recommend Cloudflare, and if I had to recommend a third party, they would certainly be on my list in some situations. The drawback I see with them is that more and more of their subnets are ending up on the blacklists due to bad behavior of some of their customers, (not anything they are doing).

[wonderpunter]

I use cloudflare.. there is a setting if your site comes under attack.. as all traffic passes through cloudflare it has to get through them first Security wise its a good economical option and not too complicated to setup.. once up and running settings are easy

[DanHorvat]

Yes I would recommend CloudFlare as the first line of defence but I haven't yet seen it in action against a real DDoS attack. All I know is that it has DDoS protection and that it says it works.

What I would recommend is to get a free trial of Acunetix and scan your site(s). That should reveal a lot.

See if CloudFlare can solve your problem.
https://www.cloudflare.com/under-attack

[Prestige]

Likewise.. Cloudflare is a good solution. You can also use the free version I assume..